LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function pngimagefinish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.
{
"cwe_ids": [
"CWE-122",
"CWE-787"
]
}[
{
"id": "CVE-2025-65018-1ff2fa39",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"166375070723291529406421301066248769034",
"275647010778297936193963675511576832388",
"256826767335212246520616614652191899280",
"279336807821086835335477021495116274772",
"289998086382119027680343151146219735692",
"127562272222925286109814353033687270978",
"25813353444574047506367402039418644046",
"253582453789718568595455958296774742498"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://github.com/glennrp/libpng/commit/49363adcfaf098748d7a4c8c624ad8c45a8c3a86",
"target": {
"file": "png.h"
}
},
{
"id": "CVE-2025-65018-485b33da",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"156580915294223224015440899088615326697",
"218405736567565762721805663647781263162",
"85662020663482796805838288188511316315",
"230686006833406113235008350425423979914",
"260919417129355689179955630465652050316",
"95506800799202743812829450076592490423"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://github.com/glennrp/libpng/commit/49363adcfaf098748d7a4c8c624ad8c45a8c3a86",
"target": {
"file": "png.c"
}
},
{
"id": "CVE-2025-65018-a8777218",
"signature_version": "v1",
"digest": {
"function_hash": "308839484675692000161271595223156832928",
"length": 481.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://github.com/glennrp/libpng/commit/49363adcfaf098748d7a4c8c624ad8c45a8c3a86",
"target": {
"file": "png.c",
"function": "png_get_copyright"
}
},
{
"id": "CVE-2025-65018-e1a15be6",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52540900908244694562855646578057113774",
"200219053898519147474761570586990540810",
"23871324486584156747326023564743243101",
"63048311541359152088830007041723625585"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://github.com/glennrp/libpng/commit/49363adcfaf098748d7a4c8c624ad8c45a8c3a86",
"target": {
"file": "pngtest.c"
}
}
]
[
{
"id": "CVE-2025-65018-09462e07",
"signature_version": "v1",
"digest": {
"function_hash": "152089211188261457050061368992955969886",
"length": 2018.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea",
"target": {
"file": "pngread.c",
"function": "png_image_finish_read"
}
},
{
"id": "CVE-2025-65018-2ef624d2",
"signature_version": "v1",
"digest": {
"function_hash": "2333317633844082296990629291887699048",
"length": 5430.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea",
"target": {
"file": "pngread.c",
"function": "png_image_read_direct"
}
},
{
"id": "CVE-2025-65018-7c05293a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"256497911793156591007313981010137330804",
"109584513501258957054077128149474560042",
"192237975258510526477257404003263997624",
"30606990160421519100275116613142310139",
"312156519594095370516028297434459873770",
"220900142416162017220967854775361553404",
"36118662072103505342061490674230260058",
"168790125413818935852173291986961269893",
"120761265379115761546610377133230135172",
"189089162184373099497428494853543124429",
"106750596262754699567758987243416013094",
"226689034820418758914997172041229489211",
"97224864048706724588862181400610346559",
"266456732266638609151505188293053155290",
"203027305669929221271641817633434951738",
"242739659333768501417776094650324945646",
"2565877639064083502211329144054449282",
"334449031200425985162851821346368123662",
"330775475673055302350346660593795397359",
"176240222955364160527702469812611380358",
"11943884251452331759710291842286533529",
"213920974765294708682054244944584079400",
"282420276832768553133997784203669148659",
"328082467098480595943018613690952846180",
"85407131502103425500873655207900827151",
"327491415051830615961273482749990703128",
"215823029670091642558595124854797180422",
"1689536822304807430628861611239673510",
"76383076396192905111578340454310377134",
"262631843307366329793905998192121463093"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea",
"target": {
"file": "pngread.c"
}
}
]